EP1492296B1 - Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain - Google Patents

Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain Download PDF

Info

Publication number
EP1492296B1
EP1492296B1 EP03076977A EP03076977A EP1492296B1 EP 1492296 B1 EP1492296 B1 EP 1492296B1 EP 03076977 A EP03076977 A EP 03076977A EP 03076977 A EP03076977 A EP 03076977A EP 1492296 B1 EP1492296 B1 EP 1492296B1
Authority
EP
European Patent Office
Prior art keywords
user
network
service
access
authentication
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Expired - Lifetime
Application number
EP03076977A
Other languages
German (de)
English (en)
Other versions
EP1492296A1 (fr
Inventor
Luis Ramos Robles
Luis Barriga
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Telefonaktiebolaget LM Ericsson AB
Original Assignee
Telefonaktiebolaget LM Ericsson AB
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to DE60313445T priority Critical patent/DE60313445T2/de
Application filed by Telefonaktiebolaget LM Ericsson AB filed Critical Telefonaktiebolaget LM Ericsson AB
Priority to EP03076977A priority patent/EP1492296B1/fr
Priority to ES03076977T priority patent/ES2281599T3/es
Priority to AT03076977T priority patent/ATE360948T1/de
Priority to PCT/EP2004/051217 priority patent/WO2005002165A1/fr
Priority to JP2006516180A priority patent/JP4394682B2/ja
Priority to US10/595,025 priority patent/US20060195893A1/en
Priority to CA2530891A priority patent/CA2530891C/fr
Priority to CN200480018065.3A priority patent/CN1813457B/zh
Publication of EP1492296A1 publication Critical patent/EP1492296A1/fr
Application granted granted Critical
Publication of EP1492296B1 publication Critical patent/EP1492296B1/fr
Anticipated expiration legal-status Critical
Expired - Lifetime legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0823—Network architectures or network communication protocols for network security for authentication of entities using certificates
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/162—Implementing security features at a particular protocol layer at the data link layer

Definitions

  • the present invention generally relates to Single Sign-On services for a plurality of users accessing a service network via a non-trusted access network. More particularly, the invention relates to a telecommunication apparatus, user equipment and method for Single Sign-On authentication purposes when the access network does not provide data origin authentication.
  • SSO Single Sign-On
  • IdP Identity Provider
  • SP Service Providers
  • the user's terminal is the one that supports the different authentication mechanisms necessary to access the different services.
  • the terminal stores the different passwords instead of the user itself.
  • this approach still puts the burden of supporting different authentication mechanisms on the user or terminal side.
  • the user needs to register itself to every entity playing the role of Service Provider (SP), so that every said entity has the necessary information about the user like, for example, user identity and password, address for mail deliveries, contact information, payment mode, etc.
  • SP Service Provider
  • a user is just authenticated towards one central entity, which plays the role of Identity Provider (IdP) for said user.
  • IdP Identity Provider
  • the Service Provider (SP) is presented one or more service credentials from the Identity Provider (IdP), thus stating that the user has been authenticated and providing the necessary information about the user.
  • this mechanism requires a business relation between the SP and the IdP.
  • MNO Mobile Network Operator
  • MNO Mobile Network Operator
  • the user controls the access authentication and, at the same time, assumes the role of IdP.
  • the user performs an authentication with the Core Network (CN) in order to gain access to the network, such as during a General Packet Radio Service (GPRS) authentication or Circuit Switched authentication, and the IdP relies on this authentication so that a new authentication towards the IdP is not needed, provided that the IdP has the means to obtain that information from the CN.
  • GPRS General Packet Radio Service
  • the Identity Provider can only rely on the Core Network (CN) authentication if the Access Network, which the user is accessing through, provides data origin authentication. This is the case, for example, when the user is accessing through a GPRS access network.
  • CN Core Network
  • data origin authentication means that for any data received from the Access Network, and whichever the originator is, the claimed originator of said data can be considered authentic.
  • WLAN Wireless Local Area Network
  • the SSO principle implies that once a user has performed a Core Network (CN) authentication, such user gets access to services in a variety of networks without a further explicit authentication by virtue of a Single Sign-On (SSO) support, and wherein the Home Network holding a user's subscription assumes the role of IdP for such user.
  • CN Core Network
  • SSO Single Sign-On
  • a user may be authenticated by the user's Home Core Network where the user holds a subscription, or by a Visited Core Network where the user is roaming.
  • the present description refers hereinafter to a Core Network authentication regardless whether the home or the visited network was the one authenticating the user.
  • CN Core Network
  • IP addresses assigned by said CN
  • Any data originated at the mobile station can be considered authentic.
  • said IP address can be considered as the user's pseudo-identity during the period said IP address is allocated to the user's mobile station.
  • MSISDN mobile subscriber directory number
  • the first one is the so-called Walled-Garden SSO and refers to the usage of SSO for services that are offered by the same entity that offers SSO, namely Local Services throughout this description. There are no open specifications, or standard technology, supporting this business model.
  • SSO Single Sign-On
  • Walled garden the Walled Garden
  • Federated SSO the Access Network provides data origin authentication
  • a user just performs an access authentication and once this step has been accomplished, SSO can be used to gain access to a number of services without any new authentication process.
  • the access network is a GPRS network
  • the entity playing the role of Identity Provider has assurance that any request for service credentials received from a user with a given IP address comes indeed from that user, and not from an attacker performing IP spoofing.
  • the IdP can provide the requested service credentials to the user without performing any extra authentication.
  • US-6253327 discloses an apparatus and method for a user being assigned with an IP address once authenticated by a network, this IP address being used as a proof of being authenticated through a negotiated point-to-point protocol session, thus eliminating needs for further authentications when the user accesses public or private network areas. This is an acceptable solution when the access network provides data origin authentication such as a point-to-point protocol session allows.
  • the current state of art does not offer a safe solution for Single Sign-On authentication when the Access Network does not provide data origin authentication, since the given IP address identifying the user is not under control of the Mobile Network Operator (MNO) and might be in use by an attacker performing IP spoofing.
  • MNO Mobile Network Operator
  • the use of a tunnelling mechanism through a secure gateway for authenticating a user accessing a private network, with addition and strip off IP addresses for network entities in the private network and binding functions to associate the origin of a request with the destination of a corresponding response, in order to avoid a direct access from the access network to the private network, as shown in US-6571289, is not helpful when the access network does not provide data origin authentication, and does not preclude intrusions from an attacker user performing IP spoofing.
  • the present invention is aimed to overcome this limitation in such a manner that a Mobile Network Operator (MNO) providing access through an Access Network not able to provide data origin authentication, such as WLAN, can re-utilise the original access authentication for SSO.
  • MNO Mobile Network Operator
  • the present invention is addressed to overcome this limitation, at least, under a network-centric approach.
  • the apparatus in accordance with the invention is arranged for receiving a Single Sign-On service request in a telecommunication service network from a user, via an access network that does not provide data origin authentication, whereas the user had received access credentials as a result of having been authenticated by the Core Network.
  • This apparatus comprises:
  • the apparatus is preferably arranged with means for generating service credentials usable for the user accessing certain services requiring specific authorisation evidences. Additionally, these means are arranged to generate service credentials on a per service basis for the user and upon service request.
  • the apparatus is preferably provided with means for communicating with an Authentication Server of the home network in order to check the validity of the access credentials received from the user, when said access credentials are not signed by a recognised authentication entity.
  • the apparatus may be advantageously implemented with different components, wherein the means for establishing the secure tunnel with a user are included in a first device named Secure Service Entry Point, and the means for linking session data, access credentials and assigned internal IP address for the user are included in a second device named Single Sign-On server. Under this approach, the apparatus further comprises means for communicating said first and second devices, namely the Secure Service Entry Point with the Single Sign On Server.
  • the apparatus of the present invention preferably comprises means for an additional co-ordination with an Identity Provider in charge of said user in the home network.
  • Said means for additional co-ordination are preferably located at the Single Sign On Server, though they may be alternatively located at the Secure Service Entry Point as well.
  • the apparatus includes means for checking whether the user had been previously authenticated or not. Therefore, the apparatus may be provided with means for communicating with an intermediate entity arranged to intercept the user's access to the HTTP local service, or to the external service in an external network.
  • this intermediate entity may be an HTTP-proxy, or a general purpose firewall arranged to this end.
  • the apparatus In operation for an other exemplary use when the user is accessing a non-HTTP local service, the apparatus also includes means for checking whether the user had been previously authenticated or not.
  • the apparatus also includes means for checking whether the user had been previously authenticated or not.
  • the fact of being an HTTP service or a non-HTTP service does not determine the advantages or drawbacks of having the intermediate entity, but rather show different configurations that are compatible with the apparatus of the present invention.
  • the user equipment in accordance with the invention is arranged to carry out an authentication procedure with a core network, and includes means for establishing a secure tunnel with a service network, through an access network not providing data origin authentication, wherein the secure tunnel makes use of an outer IP address assigned by said access network, and the user equipment also includes:
  • the user equipment advantageously includes means for linking an internal IP address, which is received as an inner IP address within the tunnelled traffic, with the access credentials and with the secure tunnel. This way, further accesses to particular services may easily encounter at the user equipment the previously assigned IP address as a pseudo-identity to directly access said particular services.
  • the means for obtaining access credentials at the user equipment includes:
  • a method for supporting Single Sign-On services in a telecommunication service network for a user accessing said service network through an access network unable to provide data origin authentication, the user authenticated by a core network comprising the steps of:
  • the method further comprises a step of linking an internal IP address received as an inner IP address within the tunnelled traffic with the access credentials and with the secure tunnel at the user equipment side.
  • the method also aligned with preferred corresponding features in the above apparatus, further comprises a step of generating service credentials for the user.
  • This step may additionally include a step of generating service credentials on a per service basis for the user upon service request.
  • the step of checking the validity of access credentials received from the user at the service network further includes a step of communicating with an Authentication Server of the home network, when said access credentials are not signed by a recognised authentication entity.
  • the method may further include a step of communicating a first device named Secure Service Entry Point, in charge of the secure tunnel, with a second device named Single Sign On Server (N-42) where the step of linking session data, access credentials and assigned internal IP address for the user takes places.
  • a first device named Secure Service Entry Point
  • N-42 Single Sign On Server
  • the method when the user is accessing to a local service, or to an external service in a network different than the currently accessed service network, the method further includes means for checking whether the user had been previously authenticated or not.
  • FIG. 1 shows a basic overview of a known architecture for an access control based on an Extensible Authentication Protocol.
  • FIG. 2 illustrates an overview of an exemplary architecture and interfaces, focusing on entities and interfaces involved when the user is authenticated by the user's home network, and is further accessing a service network, via an access network not providing data origin authentication, the service network re-utilising the access authentication.
  • FIG. 3 shows a flow sequence describing a currently preferred embodiment for a user to obtain access credentials as a result of being authenticated by the user's home core network.
  • Fig. 4 shows a first overview of the exemplary architecture and interfaces shown in Fig. 2, focusing on a preferred operation when the user is accessing a local HTTP service.
  • Fig. 5 shows a second overview of the exemplary architecture and interfaces shown in Fig. 2, focusing on a preferred operation when the user is accessing a local non-HTTP service, or a local HTTP service without help of any intermediate entity such as an HTTP-proxy or firewall.
  • Fig. 6 shows a third overview of the exemplary architecture and interfaces shown in Fig. 2, focusing on a preferred operation when the user is accessing an external service in a network different than the currently accessed service network.
  • the following describes currently preferred embodiments of an apparatus, user equipment and method for offering a user the possibility to gain Single Sign-On (SSO) services when accessing through an Access Network not providing data origin authentication, such as when accessing through a Wireless Local Area Network (WLAN).
  • SSO Single Sign-On
  • the present invention presents several aspects in connection with the user equipment, with the visited service network, which in particular may be the home service network, and with the establishment of a secure tunnel between said user terminal and said visited service network through an Access Network not providing data origin authentication.
  • a service network N-40
  • an authentication or access credential is hereinafter referred to as an "access credential”.
  • GAS Generic Access Server
  • N-22 in the Access Network
  • EAP Extensible Authentication Protocol framework
  • the Extensible Authentication Protocol provides an authentication framework arranged to support multiple authentication mechanisms.
  • EAP has been implemented with hosts and routers that connect each other via switched circuits, or dial-up lines, using a Point-to-Point Protocol (PPP).
  • PPP Point-to-Point Protocol
  • EAP has been also implemented with switches accordingly with an IEEE802 standard such as 802.1X-2001, for instance, wherein EAP messages are encapsulated.
  • N-21 Network Access Server
  • NAS Network Access Server
  • a user tries to get access to the network.
  • a PPP or IEEE 802-based connection (S-21) is established between the client and the GAS (N-22) in the Access Network (N-20).
  • the GAS enforces authentication by communicating with an Authentication Server (N-31) in the Core Network (N-30) using an "Authentication, Authorisation and Accounting” (hereinafter AAA) suitable protocol (S-22), and acts as a pass-through for EAP messages.
  • AAA Authentication, Authorisation and Accounting
  • a conventionally suitable AAA protocol may be a Remote Authentication Dial In User Service (hereinafter RADIUS, in accordance with IETF RFC 2865) protocol that makes use of a client/server model for carrying authentication, authorisation, and configuration information between a Network Access Server (NAS) (N-21; N-22) and an Authentication Server (N-31) as Fig. 1 illustrates.
  • RADIUS Remote Authentication Dial In User Service
  • N-21; N-22 Network Access Server
  • N-31 Authentication Server
  • providers of connectivity to telecommunication networks make use of RADIUS in order to verify the identity of their users. Therefore, a user dials a well-known phone number and the modems on both ends, user and connectivity provider, establish a connection.
  • the modems in the server side are connected to a Network Access Server (NAS), which requires the user to authenticate before granting access to the network by asking (S-11) for a login name and password.
  • the Network Access Server (NAS) (N-21; N-22) uses the RADIUS protocol to communicate (S-12) over the network with a RADIUS server (N-31) that collects the information forwarded from the NAS about the user, such as login name and password, to authenticate the user.
  • the authentication process may require or not that the RADIUS server sends a number of challenges to the NAS, which the user should be able to respond for.
  • the RADIUS server (N-31) indicates to the NAS (N-21; N-22) whether or not the user (N-10; N-11) is permitted to access the network.
  • Another AAA protocol suitable for use may be DIAMETER, which is an evolution of RADIUS.
  • an EAP authentication is carried out (S-23) end-to-end between the user (N-10) and the Authentication Server (N-31) through a Generic Access Server (N-22) of the Access Network (N-20), which in particular might be the Network Access Server (N-21) of Fig. 1, for example.
  • one or several access credentials are distributed, or agreed on, particularly between the user (N-10) and the Home Network (N-30) or, more generally, between the user and the Core Network, regardless whether the Core Network authenticating the user is the home or a visited network.
  • S-24 secure tunnel
  • N-40 Service Network
  • This secure tunnel (S-24) namely a secure communication channel, must provide at least data origin authentication, or a functional equivalence thereof, as aimed by this first aspect of the present invention.
  • the received digital signature is checked and, if it is correct, a short-lived digital certificate is generated for the user's public key.
  • This certificate is returned from the Authentication server (N-31) to the user's terminal side (N-10) together with a message indicating a successful authentication.
  • the user's terminal side may simply generate a request for a digital certificate to be submitted with the authentication challenge's response.
  • the short-lived digital certificate thus obtained by virtue of this preferred embodiment, or another, is a sort of access credential to be linked at the user's terminal side with a secure tunnel in accordance with this first aspect of the present invention.
  • the access credentials like the above short-lived certificate, are distributed to the user (N-10) from the Authentication Server (N-31), which in turn may obtain them from a separate Credential Provider (N-32).
  • the Authentication Server (N-31) itself generates such access credentials.
  • the access credentials may be electronically signed by the Authentication Server (N-31) or by the Credential Provider (N-32).
  • An alternative embodiment is that some cryptographic material is derived at both the Authentication Server (N-31) and the user equipment (N-10), and subsequently used as an access credential. In the latter case, it is not necessary to distribute the access credentials from the Authentication Server towards the user, but then the resulting access credentials would not be signed by the Core Network (N-30).
  • the access credentials obtained from the Core Network (N-30) during the access authentication are used to set up a secure tunnel (S-24) between the user (N-10) and an entity (N-41) in the home or visited Service Network (N-40), named Secure Service Entry Point (hereinafter SSEP) in the instant specification.
  • SSEP Secure Service Entry Point
  • a communication channel (S-25) is preferably needed between the SSEP (N-41) and the Authentication Server (N-31), so that the SSEP can check with the Authentication Server whether the access credentials provided by the user (N-10) are acceptable.
  • the SSEP (N-41) is preferably arranged to accept them as valid access credentials signed by the Authentication Server (N-31) or by the Credential Provider (N-32).
  • the secure communication channel (S-24) between the user (N-10) and the SSEP (N-41) must provide at least data origin authentication. This way, all traffic received over this secure communication channel can be assumed to come from the claimed user and not from an attacker masquerading the user.
  • a new mechanism at an entity of a home or visited service network for maintaining session information associated to the user and for linking said session information with the establishment and tear-down of the secure tunnel.
  • This entity is preferably a Single Sign-On (SSO) Server (N-42) in co-operation with the above Secure Service Entry Point (SSEP) (N-41), in a currently preferred embodiment, though it may also be either one of them solely.
  • SSO Single Sign-On
  • SSEP Secure Service Entry Point
  • the SSEP exchanges information (S-26) with the SSO Server (N-42), in order to assign an IP address to the user, for being used in the tunnelled traffic.
  • This IP address may belong to a pool of IP addresses handled by the Service Network.
  • the SSEP (N-41) lets the SSO Server (N-42) know that said user (N-10) has established a session.
  • the SSO Server (N-42) can have assurance that further requests for service credentials received with said internal IP address come indeed from the corresponding user.
  • the SSO Server needs an additional co-ordination with the Identity Provider (IdP) in charge of said user, namely with an entity of the Home Service Network playing the role of IdP, not shown in any drawing.
  • IdP Identity Provider
  • the user can at this stage enjoy the Single Sign-On (SSO) services at his or her convenience, even when having accessed through an Access Network not able to provide data origin authentication.
  • the user may be operating under any of the business models commented above, namely under the Walled-Garden model or under the Federated Single-Sign-On model, in accordance with nowadays preferred respective embodiments described following this.
  • an intermediate node (N-43) intercepts the access (S-30, S-29) to the HTTP local service.
  • This intermediate node (N-43) which is preferably an HTTP-Proxy though a general purpose firewall might be arranged to this end as well, queries (S-28) the SSO Server (N-42) on whether the user had been previously authenticated or not.
  • a pseudo-identity to identify the user in this case is the previously assigned IP address that ensures data origin authentication.
  • the SSO Server (N-42) receiving such query checks that there is an active session tagged with said IP address, and sends an acknowledgement or, rather, a service credential to the HTTP-proxy (N-43), the latter allowing the user's (N-10) access to the HTTP local service (N-44) and, optionally, allocating a cookie into the user's terminal browser.
  • This cookie if provided, may be further used to identify the user (N-10) without needing further checks with the SSO Server (N-42) in subsequent requests for HTTP-services.
  • the Local Service (N-45) may be directly accessed (S-24, S-31) from the user terminal side (N-10), likely through the SSEP (N-41).
  • the requested local service (N-45) makes use of the previously assigned IP address as a pseudo-identity to directly query (S-32) the SSO Server (N-42) on whether the user had been previously authenticated.
  • the SSO Server (N-42) receiving such query checks that there is an active session tagged with said IP address, and sends an acknowledgement or, rather, a service credential to the Local Service (N-45) for allowing the user's (N-10) access.
  • the user (N-10) attempts to access an external service (N-51) and, accordingly with the LAP protocols, the user's browser (N-10) is redirected (S-30, S-33) to a 3 rd party SP (N-51), namely an external service. Then, the 3 rd party SP (N-51) requests (S-33, S-28) a service authorisation to the SSO Server (N-42) with a given IP address that had been previously assigned when the user provided the access credentials.
  • the SSO Server (N-42) checks under SSO premises the authentication and authorisation status for the user assigned with said given IP address as pseudo-identifier and, then, returns a service credential that may be used to sign-on to the requested 3 rd party SP.
  • the SSO Server might as well allocate a cookie as for the above first embodiment.
  • the SSEP communicates with the SSO Server in order to de-allocate the internal IP address, and to delete the user related session information in the SSO Server.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Claims (23)

  1. Appareil (N-41, N-42) conçu pour recevoir une demande de service à Authentification Unique dans un réseau de services de télécommunications (N-40) d'un utilisateur (N-10) via un réseau d'accès (N-20) incapable d'assurer l'authentification d'une origine de données, l'utilisateur (N-10) ayant reçu (S-23) des autorisations d'accès comme résultat de son authentification par un coeur de réseau (N-30), l'appareil comprenant :
    - un moyen pour recevoir (S-24) les autorisations d'accès de l'utilisateur (N-10) par l'intermédiaire du réseau d'accès (N-20) ;
    - un moyen pour vérifier (N-41 ; S-25, N-31) la validité des autorisations d'accès reçues de l'utilisateur (N-10) ;
    - un moyen pour établir une session valide avec l'utilisateur (N-10) en cas de réussite de la vérification de validité des autorisations d'accès ;
    - un moyen pour affecter une adresse IP interne pour identifier l'utilisateur dans le réseau de services (N-40) ; et
    - un moyen pour relier entre elles (N-41, S-26, N-42) des données de session, des autorisations d'accès et une adresse IP interne affectée pour l'utilisateur (N-10) ;
    - un moyen pour établir un tunnel sécurisé (S-24) avec l'utilisateur (N-10) lors de la réception des autorisations d'accès par l'intermédiaire du réseau d'accès (N-20) en utilisant une adresse IP externe affectée à l'utilisateur par le réseau d'accès pour s'adresser à l'utilisateur, et en utilisant l'adresse IP interne affectée pour identifier l'utilisateur dans le réseau de services (N-40) en tant qu'adresse IP interne dans le trafic en tunnel.
  2. Appareil selon la revendication 1, comprenant en outre un moyen pour générer des autorisations de services (N-41, S-26, N-42) pour autoriser l'utilisateur à accéder à un service dans le réseau de services (N-40).
  3. Appareil selon la revendication 2, dans lequel les autorisations de services sont générées (N-41, S-26, N-42) service par service pour l'utilisateur lors d'une demande de service.
  4. Appareil selon la revendication 1, comprenant en outre un moyen pour communiquer (S-25) avec un Serveur d'Authentification (N-31) du réseau de départ (N-30) pour vérifier la validité des autorisations d'accès reçues de l'utilisateur (N-10), lorsque lesdites autorisations d'accès ne sont pas signées par une entité d'authentification reconnue (N-31).
  5. Appareil selon la revendication 1, dans lequel les moyens d'établissement du tunnel sécurisé (S-24) avec l'utilisateur (N-10) sont inclus dans un premier dispositif nommé Point d'Entrée de Service Sécurisé (N-41), et les moyens d'établissement d'un lien entre des données de session, des autorisations d'accès et une adresse IP interne affectée pour l'utilisateur (N-10) sont inclus dans un deuxième dispositif nommé serveur à Authentification Unique (N-42).
  6. Appareil selon la revendication 5, comprenant en outre un moyen pour faire communiquer (S-26) le Point d'Entrée de Service Sécurisé (N-41) avec le Serveur à Authentification Unique (N-42).
  7. Appareil selon la revendication 1, comprenant en outre un moyen pour une coordination supplémentaire (S-25) entre l'appareil (N-41 ; N-42) et un Fournisseur d'Identité (N-31) en charge dudit utilisateur dans un réseau de départ (N-30) lorsque ledit réseau de départ est différent du réseau de services (N-40) pour lequel l'appareil est le point d'entrée.
  8. Appareil selon la revendication 1, destiné à être utilisé lorsque l'utilisateur (N-10) accède à un service local HTTP (N-44) ou à un service externe (N-51) dans un réseau (N-50) différent du réseau de services auquel un accès est effectué à l'instant courant (N-40), l'appareil ayant des moyens pour vérifier (N-41, S-30, N-43, S-28, N-42) si oui ou non l'utilisateur a déjà été authentifié.
  9. Appareil selon la revendication 8, ayant des moyens (S-30, S-28) pour communiquer avec une entité intermédiaire (N-43) conçue pour intercepter l'accès de l'utilisateur (S-29) au service local HTTP (N-44), ou au service externe (N-51) dans un réseau externe (N-50).
  10. Appareil selon la revendication 9, dans lequel l'entité intermédiaire (N-43) est un mandataire HTTP.
  11. Appareil selon la revendication 9, dans lequel l'entité intermédiaire (N-43) est un pare-feu.
  12. Appareil selon la revendication 1, destiné à être utilisé lorsque l'utilisateur (N-10) accède à un service local non HTTP (N-45), ayant des moyens pour vérifier (N-41, S-31, N-45, S-32, N-42) si oui ou non l'utilisateur a déjà été authentifié.
  13. Appareil selon la revendication 1, dans lequel le moyen de réception d'autorisations d'accès comprend un moyen pour vérifier si un certificat numérique délivré par le coeur de réseau est présent pour indiquer une authentification réussie de l'utilisateur.
  14. Équipement utilisateur (N-10 ; N-11) conçu pour effectuer une procédure d'authentification sur un coeur de réseau (N-30), et conçu pour accéder à un réseau de services de télécommunications (N-40) via un réseau d'accès (N-20) incapable d'assurer l'authentification d'une origine de données, l'équipement utilisateur (N-10 ; N-11) comprenant :
    - un moyen pour obtenir (S-23) des autorisations d'accès comme résultat de son authentification par le coeur de réseau (N-30) ;
    - un moyen pour envoyer (S-24) les autorisations d'accès au réseau de services (N-40) lors d'un accès par l'intermédiaire du réseau d'accès (N-20) ;
    - un moyen pour établir un tunnel sécurisé (S-24) avec le réseau de services (N-40) par l'intermédiaire du réseau d'accès (N-20), le tunnel sécurisé utilisant une adresse IP externe affectée à l'utilisateur par le réseau d'accès pour s'adresser à l'utilisateur ;
    - un moyen pour recevoir (S-24) une adresse IP interne affectée par le réseau de services (N-40) et incluse comme une adresse IP interne au sein du trafic en tunnel pour identifier l'utilisateur sur le réseau de services ; et
    - un moyen pour relier lesdites autorisations d'accès à l'adresse IP interne et au tunnel sécurisé.
  15. Équipement utilisateur (N-10 ; N-11) selon la revendication 14, dans lequel le moyen d'obtention d'autorisations d'accès comporte :
    - un moyen pour recevoir un défi d'authentification du coeur de réseau ;
    - un moyen pour générer et renvoyer une réponse d'authentification au coeur de réseau ;
    - un moyen pour générer une paire de clés publique et privée ; et
    - un moyen pour soumettre la clé publique en association avec une signature numérique prouvant la propriété de la clé privée au coeur de réseau.
  16. Équipement utilisateur (N-10 ; N-11) selon la revendication 14, dans lequel le moyen d'obtention d'autorisations d'accès comporte :
    - un moyen pour recevoir un défi d'authentification du coeur de réseau ;
    - un moyen pour générer et renvoyer une réponse d'authentification au coeur de réseau ; et
    - un moyen pour demander un certificat numérique pouvant être obtenu du coeur de réseau.
  17. Équipement utilisateur (N-10 ; N-11) selon la revendication 16, dans lequel le moyen d'obtention d'autorisations d'accès comporte en outre un moyen pour générer une clé publique pour laquelle le certificat numérique peut être obtenu.
  18. Procédé de prise en charge de services à Authentification Unique dans un réseau de services de télécommunications (N-40) pour un utilisateur (N-10) accédant audit réseau de services (N-40) par l'intermédiaire d'un réseau d'accès (N-20) incapable d'assurer l'authentification d'une origine de données, l'utilisateur (N-10) ayant reçu (S-23) des autorisations d'accès comme résultat de son authentification par un coeur de réseau (N-30), le procédé comprenant les étapes consistant à :
    - recevoir (S-24) sur le réseau de services (N-40) les autorisations d'accès de l'utilisateur (N-10) par l'intermédiaire du réseau d'accès (N-20) ;
    - vérifier (N-41, S-25, N-31) la validité des autorisations d'accès reçues sur le réseau de services (N-40) ;
    - établir (N-41, S-26, N-42) une session valide avec l'utilisateur (N-10) lors d'une vérification de validité réussie des autorisations d'accès ;
    - affecter sur le réseau de services (N-41 ; S-26, N-42) une adresse IP interne pour l'utilisateur (N-10) pour identifier l'utilisateur lors de l'accès à un service sur le réseau de services ; et
    - relier (N-41 ; S-26, N-42) des données de session, des autorisations d'accès et l'adresse IP interne affectée pour l'utilisateur (N-10) sur une entité (N-41 ; N-42) du réseau de services (N-40) ;
    - établir un tunnel sécurisé (S-24) entre le côté formant équipement utilisateur (N-10) et une entité (N-41) du réseau de services (N-40) par l'intermédiaire du réseau d'accès (N-20) en utilisant une adresse IP externe affectée par le réseau d'accès pour s'adresser à l'utilisateur, et en utilisant en tant qu'adresse IP interne dans le trafic en tunnel l'adresse IP interne affectée pour identifier l'utilisateur sur le réseau de services (N-40) ; et
    - relier lesdites autorisations d'accès à ladite adresse IP interne et audit tunnel sécurisé du côté formant équipement utilisateur (N-10).
  19. Procédé selon la revendication 18, comprenant en outre une étape consistant à générer des autorisations de services (N-41, S-26, N-42) pour autoriser l'utilisateur à accéder à un service sur le réseau de services (N-40).
  20. Procédé selon la revendication 19, dans lequel l'étape consistant à générer des autorisations de services comprend une étape consistant à générer, service par service, des autorisations de services pour l'utilisateur lors d'une demande de service.
  21. Procédé selon la revendication 18, dans lequel l'étape de vérification (N-41 ; N-41, S-25, N-31) de la validité des autorisations d'accès reçues de l'utilisateur (N-10) sur le réseau de services (N-40) comprend en outre une étape consistant à communiquer (S-25) avec un Serveur d'Authentification (N-31) du réseau de départ (N-30), lorsque lesdites autorisations d'accès ne sont pas signées par une entité d'authentification reconnue.
  22. Procédé selon la revendication 18, dans lequel l'étape consistant à relier des données de session, des autorisations d'accès et une adresse IP interne affectée pour l'utilisateur (N-10) comprend en outre une étape consistant à faire communiquer (S-26) un premier dispositif nommé Point d'Entrée de Service Sécurisé (N-41) en charge du tunnel sécurisé (S-24) avec un deuxième dispositif nommé Serveur à Authentification Unique (N-42) sur lequel s'effectue l'étape d'établissement de lien.
  23. Procédé selon la revendication 18, destiné à être utilisé lorsque l'utilisateur (N-10) accède à un service local (N-44 ; N-45) ou à un service externe (N-51) sur un réseau (N-50) différent du réseau de services auquel un accès est effectué à l'instant courant (N-40), le procédé comprenant en outre une étape consistant à vérifier (S-28, N-42 ; S-32, N-42) si oui ou non l'utilisateur a déjà été authentifié.
EP03076977A 2003-06-26 2003-06-26 Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain Expired - Lifetime EP1492296B1 (fr)

Priority Applications (9)

Application Number Priority Date Filing Date Title
EP03076977A EP1492296B1 (fr) 2003-06-26 2003-06-26 Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain
ES03076977T ES2281599T3 (es) 2003-06-26 2003-06-26 Aparato y metodo para la autentificacion de identificacion unica a traves de una red de acceso no confiable.
AT03076977T ATE360948T1 (de) 2003-06-26 2003-06-26 Apparat und methode für eine authentisierung mit einmaliger passworteingabe über einen unsicheren netzwerkzugang
DE60313445T DE60313445T2 (de) 2003-06-26 2003-06-26 Apparat und Methode für eine Authentisierung mit einmaliger Passworteingabe über einen unsicheren Netzwerkzugang
PCT/EP2004/051217 WO2005002165A1 (fr) 2003-06-26 2004-06-23 Appareil et procede d'authentification d'entree unique dans un reseau a acces non valide
JP2006516180A JP4394682B2 (ja) 2003-06-26 2004-06-23 非信頼アクセスネットワークを介してシングルサインオン認証を行なう装置及び方法
US10/595,025 US20060195893A1 (en) 2003-06-26 2004-06-23 Apparatus and method for a single sign-on authentication through a non-trusted access network
CA2530891A CA2530891C (fr) 2003-06-26 2004-06-23 Appareil et procede d'authentification d'entree unique dans un reseau a acces non valide
CN200480018065.3A CN1813457B (zh) 2003-06-26 2004-06-23 通过一个不信任接入网络的单点登陆验证的设备和方法

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP03076977A EP1492296B1 (fr) 2003-06-26 2003-06-26 Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain

Publications (2)

Publication Number Publication Date
EP1492296A1 EP1492296A1 (fr) 2004-12-29
EP1492296B1 true EP1492296B1 (fr) 2007-04-25

Family

ID=33395926

Family Applications (1)

Application Number Title Priority Date Filing Date
EP03076977A Expired - Lifetime EP1492296B1 (fr) 2003-06-26 2003-06-26 Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain

Country Status (9)

Country Link
US (1) US20060195893A1 (fr)
EP (1) EP1492296B1 (fr)
JP (1) JP4394682B2 (fr)
CN (1) CN1813457B (fr)
AT (1) ATE360948T1 (fr)
CA (1) CA2530891C (fr)
DE (1) DE60313445T2 (fr)
ES (1) ES2281599T3 (fr)
WO (1) WO2005002165A1 (fr)

Families Citing this family (42)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
GB0409496D0 (en) * 2004-04-28 2004-06-02 Nokia Corp Subscriber identities
US7698734B2 (en) * 2004-08-23 2010-04-13 International Business Machines Corporation Single sign-on (SSO) for non-SSO-compliant applications
US8245280B2 (en) * 2005-02-11 2012-08-14 Samsung Electronics Co., Ltd. System and method for user access control to content in a network
US20060218629A1 (en) * 2005-03-22 2006-09-28 Sbc Knowledge Ventures, Lp System and method of tracking single sign-on sessions
US20060218630A1 (en) * 2005-03-23 2006-09-28 Sbc Knowledge Ventures L.P. Opt-in linking to a single sign-on account
US7784092B2 (en) * 2005-03-25 2010-08-24 AT&T Intellectual I, L.P. System and method of locating identity providers in a data network
US7631346B2 (en) * 2005-04-01 2009-12-08 International Business Machines Corporation Method and system for a runtime user account creation operation within a single-sign-on process in a federated computing environment
FI20050491A0 (fi) * 2005-05-09 2005-05-09 Nokia Corp Järjestelmä varmenteiden toimittamiseksi viestintäjärjestelmässä
CN100583761C (zh) * 2005-05-16 2010-01-20 联想(北京)有限公司 一种统一认证的实现方法
JP4984020B2 (ja) * 2005-08-19 2012-07-25 日本電気株式会社 通信システム、ノード、認証サーバ、通信方法及びそのプログラム
CA2632159A1 (fr) * 2005-11-24 2007-05-31 Oz Communications Inc. Procede destine a associer de facon securisee des donnees au moyen de sessions http et https
CA2527550A1 (fr) * 2005-11-24 2007-05-24 Oz Communications Methode d'association sure de donnees a des sessions https
US7561692B2 (en) * 2006-02-27 2009-07-14 Alvarion Ltd. Method of authenticating mobile terminal
US8452961B2 (en) * 2006-03-07 2013-05-28 Samsung Electronics Co., Ltd. Method and system for authentication between electronic devices with minimal user intervention
US20070288487A1 (en) * 2006-06-08 2007-12-13 Samsung Electronics Co., Ltd. Method and system for access control to consumer electronics devices in a network
US7827275B2 (en) 2006-06-08 2010-11-02 Samsung Electronics Co., Ltd. Method and system for remotely accessing devices in a network
US8261078B2 (en) * 2006-06-09 2012-09-04 Telefonaktiebolaget Lm Ericsson (Publ) Access to services in a telecommunications network
JP4882546B2 (ja) * 2006-06-28 2012-02-22 富士ゼロックス株式会社 情報処理システムおよび制御プログラム
WO2008070952A1 (fr) * 2006-12-14 2008-06-19 Bce Inc Procédé, système et dispositif pour approvisionner un client de communication
JP2008181427A (ja) * 2007-01-25 2008-08-07 Fuji Xerox Co Ltd シングルサインオンシステム、情報端末装置、シングルサインオンサーバ、プログラム
US7647404B2 (en) * 2007-01-31 2010-01-12 Edge Technologies, Inc. Method of authentication processing during a single sign on transaction via a content transform proxy service
US8307411B2 (en) 2007-02-09 2012-11-06 Microsoft Corporation Generic framework for EAP
US7941831B2 (en) * 2007-02-09 2011-05-10 Microsoft Corporation Dynamic update of authentication information
US20080222714A1 (en) * 2007-03-09 2008-09-11 Mark Frederick Wahl System and method for authentication upon network attachment
US8572716B2 (en) * 2007-04-23 2013-10-29 Microsoft Corporation Integrating operating systems with content offered by web based entities
US20090064291A1 (en) * 2007-08-28 2009-03-05 Mark Frederick Wahl System and method for relaying authentication at network attachment
US20090089870A1 (en) * 2007-09-28 2009-04-02 Mark Frederick Wahl System and method for validating interactions in an identity metasystem
US20100182970A1 (en) * 2009-01-21 2010-07-22 Qualcomm Incorporated Multiple Subscriptions Using a Single Air-Interface Resource
EP2417789B1 (fr) * 2009-04-07 2014-07-30 Togewa Holding AG Procede et systeme d'authentification de noeud de reseau dans un reseau local sans fil base sur une methode d'authentification de l'utilisateur (uam)
US8375429B2 (en) * 2009-04-09 2013-02-12 Novell, Inc. Network-based application control
US8943552B2 (en) * 2009-04-24 2015-01-27 Blackberry Limited Methods and apparatus to discover authentication information in a wireless networking environment
US8607316B2 (en) * 2010-08-31 2013-12-10 Blackberry Limited Simplified authentication via application access server
KR101556046B1 (ko) * 2010-12-30 2015-09-30 인터디지탈 패튼 홀딩스, 인크 통신 핸드오프 시나리오를 위한 인증 및 보안 채널 설정
US9088891B2 (en) 2012-08-13 2015-07-21 Wells Fargo Bank, N.A. Wireless multi-factor authentication with captive portals
US9166969B2 (en) * 2012-12-06 2015-10-20 Cisco Technology, Inc. Session certificates
US20150026772A1 (en) * 2013-07-16 2015-01-22 Samsung Electronics Co., Ltd. Media based authentication and authorization for secure services
CN104767721B (zh) * 2014-01-08 2019-03-15 阿尔卡特朗讯公司 向第三方用户提供核心网络服务的方法和网络单元
US9794266B2 (en) 2014-09-05 2017-10-17 Qualcomm Incorporated Using multiple credentials for access and traffic differentiation
CN108293049B (zh) * 2015-11-25 2022-03-18 阿卡麦科技公司 在不受控制的网络中对设备的唯一识别及与其进行安全通信
US9769668B1 (en) 2016-08-01 2017-09-19 At&T Intellectual Property I, L.P. System and method for common authentication across subscribed services
US10382428B2 (en) 2016-09-21 2019-08-13 Mastercard International Incorporated Systems and methods for providing single sign-on authentication services
KR102571829B1 (ko) * 2017-03-09 2023-08-28 마그누스 스크라스태드 굴브란센 코어 네트워크 액세스 제공자

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6105027A (en) * 1997-03-10 2000-08-15 Internet Dynamics, Inc. Techniques for eliminating redundant access checking by access filters
US6317838B1 (en) * 1998-04-29 2001-11-13 Bull S.A. Method and architecture to provide a secured remote access to private resources
US6571289B1 (en) * 1998-08-03 2003-05-27 Sun Microsystems, Inc. Chained registrations for mobile IP
US6311275B1 (en) * 1998-08-03 2001-10-30 Cisco Technology, Inc. Method for providing single step log-on access to a differentiated computer network
US6253327B1 (en) * 1998-12-02 2001-06-26 Cisco Technology, Inc. Single step network logon based on point to point protocol
WO2001072009A2 (fr) * 2000-03-17 2001-09-27 At & T Corp. Mecanisme d'authentification base sur le web et possedant une procedure d'ouverture unique
DE10043203A1 (de) * 2000-09-01 2002-03-21 Siemens Ag Generische WLAN-Architektur
WO2003104947A2 (fr) * 2002-06-06 2003-12-18 Hardt Dick C Gestion repartie des identites hierarchiques

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
CA2530891A1 (fr) 2006-01-06
ES2281599T3 (es) 2007-10-01
CN1813457B (zh) 2011-04-13
JP4394682B2 (ja) 2010-01-06
ATE360948T1 (de) 2007-05-15
EP1492296A1 (fr) 2004-12-29
DE60313445D1 (de) 2007-06-06
CN1813457A (zh) 2006-08-02
DE60313445T2 (de) 2008-01-10
CA2530891C (fr) 2014-08-12
US20060195893A1 (en) 2006-08-31
JP2009514256A (ja) 2009-04-02
WO2005002165A1 (fr) 2005-01-06

Similar Documents

Publication Publication Date Title
EP1492296B1 (fr) Appareil et méthode pour réaliser une seule authentification en début de session, à travers un réseau d'accès incertain
RU2304856C2 (ru) Способ и система, предназначенные для установления соединения через сеть доступа
KR100996983B1 (ko) 셀룰러 통신 시스템에서의 재인증 허용 방법 및 장치
JP4832756B2 (ja) Ｗｌａｎローミングの間にｇｓｍ認証を行う方法およびシステム
EP2039110B1 (fr) Procédé et système pour contrôler l'accès aux réseaux
US20050114680A1 (en) Method and system for providing SIM-based roaming over existing WLAN public access infrastructure
US20090199001A1 (en) Access to services in a telecommunications network
WO2004008715A1 (fr) Extension du protocole de telecommunications eap
CN114070597B (zh) 一种专网跨网认证方法及装置
US20040166874A1 (en) Location related information in mobile communication system
EP1530883B1 (fr) Protection de l'identite des utilisateurs dans un agencement d'interconnexion de systemes universels de telephonie mobile par reseau local sans fil
KR20040001329A (ko) 공중 무선랜 서비스를 위한 망 접속 방법
Leu et al. Running cellular/PWLAN services: practical considerations for cellular/PWLAN architecture supporting interoperator roaming
ZA200501089B (en) Method system for GSM authentication during WLAN Roaming

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20040701

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

AX Request for extension of the european patent

Extension state: AL LT LV MK

AKX Designation fees paid

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LI LU MC NL PT RO SE SI SK TR

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CH

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: LI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REF Corresponds to:

Ref document number: 60313445

Country of ref document: DE

Date of ref document: 20070606

Kind code of ref document: P

REG Reference to a national code

Ref country code: SE

Ref legal event code: TRGR

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070925

REG Reference to a national code

Ref country code: ES

Ref legal event code: FG2A

Ref document number: 2281599

Country of ref document: ES

Kind code of ref document: T3

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

NLV1 Nl: lapsed or annulled due to failure to fulfill the requirements of art. 29p and 29m of the patents act
ET Fr: translation filed
PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: BE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: MC

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20070630

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070725

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20080128

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070726

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20070626

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20070626

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HU

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20071026

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20070425

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 14

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 15

REG Reference to a national code

Ref country code: FR

Ref legal event code: PLFP

Year of fee payment: 16

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20210629

Year of fee payment: 19

Ref country code: FR

Payment date: 20210625

Year of fee payment: 19

Ref country code: IT

Payment date: 20210621

Year of fee payment: 19

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20210628

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 60313445

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: SE

Payment date: 20210630

Year of fee payment: 19

Ref country code: ES

Payment date: 20210701

Year of fee payment: 19

REG Reference to a national code

Ref country code: DE

Ref legal event code: R119

Ref document number: 60313445

Country of ref document: DE

REG Reference to a national code

Ref country code: SE

Ref legal event code: EUG

GBPC Gb: european patent ceased through non-payment of renewal fee

Effective date: 20220626

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220627

Ref country code: FR

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220630

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: GB

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220626

Ref country code: DE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20230103

REG Reference to a national code

Ref country code: ES

Ref legal event code: FD2A

Effective date: 20230728

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220626

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: ES

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20220627